Don’t use shell=True in mcp dev subprocess on Windows (command injection risk)

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

What’s happening:

When you run the mcp dev command on Windows, it starts another program using a method (subprocess.run with shell=True) that lets the Windows command prompt (cmd.exe) handle the command. This is risky because if any part of the command includes special characters (like &, |, %, etc.), Windows might run something you didn’t expect — even another program, if the file path or arguments are weirdly named or crafted.

Why this is a real problem:

• This isn’t just a theory — it’s a well-known risk with shell=True in Python. If anyone (or any script) can control part of the file path or arguments, they might be able to run extra commands on your computer.
• The Python documentation says to avoid shell=True when possible for exactly this reason.
• The fix is easy: use shell=False and make sure the right Windows executable is picked (like npx.cmd).
• This keeps things safe and works the same on all systems.

What should happen instead:

• The command should be run without shell=True on Windows, just like it is on Linux/Mac.
• File paths and arguments should always be passed as a list, not a single string.

How this could be abused:

• If someone manages to sneak a file or argument with a shell special character into your project, running mcp dev could run extra commands (for example, opening Calculator if the file had &calc in its name).

Please fix:

• Remove shell=True from the subprocess.run call in src/mcp/cli/cli.py (Windows part).
• Make sure the command and its arguments are always passed as a list.
• Make sure it works on Windows by using the right executable (like npx.cmd).

Thanks!

Example Code

# Example of risky situation on Windows:
# If a file is named "server&calc.py" and you run:
#   mcp dev path\to\server&calc.py
# Windows might run Calculator because of the &

# Please see src/mcp/cli/cli.py (mcp dev command) for the subprocess.run([npx_cmd, ...], shell=True, ...)

Python & MCP Python SDK

Python 3.11, Windows 11, latest MCP Python SDK (main branch, August 2025)

src/mcp/cli/cli.py の Windows 向け mcp dev の subprocess.run 呼び出しから始めます。コマンドと引数がどのように組み立てられているかを確認し、その後、Windows に適した実行可能ファイルが選択され、引数が shell=True なしでリストとして渡されていることを検証します。mcp dev が Windows 上で実行され、パスや引数内のシェルメタ文字が追加のコマンドとして解釈されなければ完了です。